espressif/binutils-gdb
1
0
Fork 0
mirror of https://github.com/espressif/binutils-gdb.git synced 2025-06-18 08:38:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

PR26574, heap buffer overflow in _bfd_elf_slurp_secondary_reloc_section

Browse Source 
A horribly fuzzed object with section headers inside the ELF header.
Disallow that, and crazy reloc sizes.

	PR 26574
	* elfcode.h (elf_object_p): Sanity check section header offset.
	* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
	sh_entsize.
This commit is contained in:
Alan Modra
2020-09-04 19:19:18 +09:30
parent 1e3b96fd6c
commit 8642dafaef
3 changed files with 14 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
bfd/ChangeLog
View File

@ -1,3 +1,10 @@
2020-09-04 Alan Modra <amodra@gmail.com>
PR 26574
* elfcode.h (elf_object_p): Sanity check section header offset.
* elf.c (_bfd_elf_slurp_secondary_reloc_section): Sanity check
sh_entsize.
2020-09-04 Alan Modra <amodra@gmail.com> 2020-09-04 Alan Modra <amodra@gmail.com>
PR 15146 PR 15146

4
bfd/elf.c
View File

@ -12576,7 +12576,9 @@ _bfd_elf_slurp_secondary_reloc_section (bfd * abfd,
Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr; Elf_Internal_Shdr * hdr = & elf_section_data (relsec)->this_hdr;
if (hdr->sh_type == SHT_SECONDARY_RELOC if (hdr->sh_type == SHT_SECONDARY_RELOC
&& hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx) && hdr->sh_info == (unsigned) elf_section_data (sec)->this_idx
&& (hdr->sh_entsize == ebd->s->sizeof_rel
|| hdr->sh_entsize == ebd->s->sizeof_rela))
{ {
bfd_byte * native_relocs; bfd_byte * native_relocs;
bfd_byte * native_reloc; bfd_byte * native_reloc;

8
bfd/elfcode.h
View File

@ -571,7 +571,7 @@ elf_object_p (bfd *abfd)
/* If this is a relocatable file and there is no section header /* If this is a relocatable file and there is no section header
table, then we're hosed. */ table, then we're hosed. */
if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_type == ET_REL) if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_type == ET_REL)
goto got_wrong_format_error; goto got_wrong_format_error;
/* As a simple sanity check, verify that what BFD thinks is the /* As a simple sanity check, verify that what BFD thinks is the
@ -581,7 +581,7 @@ elf_object_p (bfd *abfd)
goto got_wrong_format_error; goto got_wrong_format_error;
/* Further sanity check. */ /* Further sanity check. */
if (i_ehdrp->e_shoff == 0 && i_ehdrp->e_shnum != 0) if (i_ehdrp->e_shoff < sizeof (x_ehdr) && i_ehdrp->e_shnum != 0)
goto got_wrong_format_error; goto got_wrong_format_error;
ebd = get_elf_backend_data (abfd); ebd = get_elf_backend_data (abfd);
@ -618,7 +618,7 @@ elf_object_p (bfd *abfd)
&& ebd->elf_osabi != ELFOSABI_NONE) && ebd->elf_osabi != ELFOSABI_NONE)
goto got_wrong_format_error; goto got_wrong_format_error;
if (i_ehdrp->e_shoff != 0) if (i_ehdrp->e_shoff >= sizeof (x_ehdr))
{ {
file_ptr where = (file_ptr) i_ehdrp->e_shoff; file_ptr where = (file_ptr) i_ehdrp->e_shoff;
@ -819,7 +819,7 @@ elf_object_p (bfd *abfd)
} }
} }
if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff != 0) if (i_ehdrp->e_shstrndx != 0 && i_ehdrp->e_shoff >= sizeof (x_ehdr))
{ {
unsigned int num_sec; unsigned int num_sec;